The answer is the Guest invite settings under External Identities – External collaboration settings in Microsoft Entra ID. This is correct because the default configuration allows anyone in the organization to invite external users, which directly contradicts the requirement to restrict guest invitations to administrators. By changing this setting to “Only users assigned to specific admin roles can invite guest users,” you ensure that only designated administrators—such as Global Administrators or Guest Inviters—can send invitations, effectively locking down external collaboration. On the MS-102 exam, this scenario tests your understanding of identity governance and least-privilege principles, often appearing as a straightforward configuration question where the trap is confusing this with SharePoint or Teams external sharing settings. A common memory tip: think of the “Guest invite settings” as the master switch for who can open the door to outsiders—set it to admin-only to keep the tenant’s guest list tightly controlled.
MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
This MS-102 practice question tests your understanding of deploy and manage a microsoft 365 tenant. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?
The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
This setting controls who can invite guest users; it can be changed to restrict invitations to administrators.
Related concept
Read the scenario before looking for a memorised answer.
✗
Conditional Access policy to block external users
Why it's wrong here
Conditional Access controls access but does not prevent users from sending invitations.
✗
Tenant restrictions
Why it's wrong here
Tenant restrictions limit access to only authorized tenants but do not control invitation permissions.
✗
B2B direct connect
Why it's wrong here
B2B direct connect is used for seamless collaboration between tenants without inviting users as guests.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'blocking external users' via Conditional Access (Option B) with controlling the invitation process, but Conditional Access only applies after the user is already in the directory, not to the invitation permission itself.
Detailed technical explanation
How to think about this question
The External collaboration settings leverage the Azure AD B2B invitation model, which uses the Microsoft Graph API and the 'invitationManager' role to control who can send invitations. Under the hood, changing this setting modifies the 'allowedToInviteGuests' property in the Azure AD directory settings. In a real-world scenario, a company might combine this with a Conditional Access policy requiring MFA for guest users to enforce layered security.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Deploy and manage a Microsoft 365 tenant — This question tests Deploy and manage a Microsoft 365 tenant — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: External Identities – External collaboration settings — The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.